Ref: https://our.umbraco.com/forum/extending-umbraco-and-using-the-api/92375-best-way-to-authenticate-umbraco-api-request-as-back-office-user

I'm having a similar issue with a new API I'm writing for a 7.15.3 site. As I understand it, inheriting from UmbracoAuthorizedApiController means you don't need to decorate the methods with [UmbracoAuthorize].

My problem is that I don't appear to be able to get authorisation with my request. All I get in return is {"Message":"Authorization has been denied for this request."} In Postman I'm adding an Authorization header of Type "Basic Auth" with a correct username and password for a backoffice user.

If I change the API to inherit from UmbracoApiController and change the route from /umbraco/backoffice/api/ to /umbraco/api/ it returns the expected JSON, so it's just the authorisation I'm having a problem with.

The API is called from other websites.

Relevant code here:

namespace MySite.Web.Controllers.ApiControllers.NewsAndEvents
{
    public class NewsAndEventsApiController : UmbracoAuthorizedApiController
        {

        string siteAddress = HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Authority);

        [HttpPost]
        public ArticleListResponseModel GetArticleList (ArticleListRequestModel jsonRequest) {

            ArticleListResponseModel returnArticleList = new ArticleListResponseModel();
         .... More  code....
        }
    }
}

Am I missing a trick somewhere? Any advice would be appreciated.

//Craig